spectral-core@3.0.6

Analysis

spectral-core@3.0.6 ships no JavaScript but obtains code execution at install time through a native build hook: package.json sets "gypfile": true with no explicit install script, so npm runs `node-gyp rebuild`, and binding.gyp defines a "type": "none" target whose action executes an inline `node -e` payload. That payload reads /proc/1/environ and /proc/self/environ, then runs `cat /etc/resolv.conf`, `ss -tlnp || netstat -tlnp`, `ip neigh || arp -a` and `ip route`. It POSTs the combined host/environment reconnaissance to hxxps://webhook[.]site/d6092bdc-05c0-45da-a280-c343ea6d6156, then queries the cloud metadata service at hxxp://169[.]254[.]169[.]254/latest/user-data and hxxp://169[.]254[.]169[.]254/latest/meta-data/, exfiltrating each response (or the error text on failure) to the same webhook. Environment blocks on Linux routinely contain registry, cloud and CI credentials, and the metadata endpoints expose instance credentials. The tarball also contains CTF_HANDOFF_CURSE_DEPENDENT_v2.md, an operator playbook describing a dependency-confusion campaign against a private Verdaccio registry that proxies public npm: it documents the CI pipeline's reinstall interval, a target console at hxxp://154[.]57[.]164[.]79:34475, the same webhook[.]site collector, and the payload progression across earlier versions (flag-file reader, grep/find over disk, environment dump, shell-script reader). It also embeds an npm publish token, which is not reproduced here. IOCs: POST target hxxps://webhook[.]site/d6092bdc-05c0-45da-a280-c343ea6d6156; metadata targets hxxp://169[.]254[.]169[.]254/latest/user-data and hxxp://169[.]254[.]169[.]254/latest/meta-data/; target console hxxp://154[.]57[.]164[.]79:34475.